On The Nonlinearity of Maximum-length NFSR
Feedbacks
Meltem S¨onmez Turan
National Institute of Standards and Technology [email protected]
Abstract. Linear Feedback Shift Registers (LFSRs) are the main build-ing block of many classical stream ciphers; however due to their inherent linearity, most of the LFSR-based designs do not offer the desired secu-rity levels. In the last decade, using Nonlinear Feedback Shift Registers (NFSRs) in stream ciphers became very popular. However, the theory of NFSRs is not well-understood, and there is no efficient method that constructs a cryptographically strong feedback function with maximum period and also, given a feedback function it is hard to predict the pe-riod. In this paper, we study the maximum-length NFSRs, focusing on the nonlinearity of their feedback functions. First, we provide some upper bounds on the nonlinearity of the maximum-length feedback functions, and then we study the feedback functions having nonlinearity 2 in de-tail. We also show some techniques to improve the nonlinearity of a given feedback function using cross-joining.
1
Introduction
Feedback Shift Registers (FSRs) are commonly used in stream cipher designs, due to their efficiency, large period and good statistical properties. FSRs with linear feedback function, Linear Feedback Shift Registers (LFSRs) are widely studied in the literature [1] and it is easy to find LFSRs with maximum period, 2n−1, for a given lengthn. However, one important drawback of LFSR outputs is that they are completely linear, thus cryptographically insecure. Whenever 2n bits of the output is given, the sequence is totally predictable using the Berlekamp-Massey algorithm.
Various design attempts have been made to add nonlinearity to the ciphers based on LFSRs, such as combining outputs of several LFSRs using a nonlinear function, nonlinearly filtering the LFSR state or irregularly decimating the out-put [2]. However, most of these approaches do not offer desired security levels [3]. Due to the limitations of LFSRs, use of Nonlinear Feedback Shift Registers (NFSRs) became very popular. The eSTREAM Stream Cipher Project hardware finalists Grain [4], Mickey [5] and Trivium [6] use NFSRs as their main building blocks.
There is no efficient method that finds a cryptographically strong feedback func-tion with maximum period 2n for a givennand also, given a feedback function it is hard to predict the period.
Golomb presented a method to construct maximum-length NFSRs using primitive polynomials [1] (p. 115), however, these feedback functions have very low nonlinearity which allows them to be approximated using affine functions. Also, in 1982, Fredricksen [7] presented a survey on maximum-length NFSRs including construction methods and some properties. Tsueda et al. [8] proposed feedback-limited NFSRs and studied their properties in terms of correlation and linear complexity measures. C¸ alık et al. [9] studied maximum-length NFSRs fo-cusing on the number of monomials.
In this paper, we study the nonlinearity of the feedback functions that gen-erate maximum-length sequences. First, we provide some upper bounds on the nonlinearity of the feedback functions, and then we study the feedback functions having nonlinearity 2 in detail. We also show some techniques to increase the nonlinearity of a given feedback function using cross-joining and present some re-sults on the relation between number of monomials and nonlinearity for extreme cases.
The paper is organized as follows. In Section 2, we give a brief introduction to Boolean functions and FSRs. The properties of maximum-length NFSRs are provided in Section 3. Section 4 focuses on the nonlinearity of feedback functions. Section 5 concludes the paper.
2
Preliminaries
2.1 Boolean Functions
A Boolean function f with n variables is a mapping from Fn
2 to F2. Let αi be the n-bit vector corresponding to the binary representation of integers i = 0,1,2, . . . ,2n−1. For a Boolean function withnvariables, the sequence
(f(α0), f(α1), . . . , f(α2n−1)) (1) is called thetruth tableoff.Algebraic normal form(ANF) of a Boolean function is the polynomial
f(x1, x2, . . . , xn) =c0⊕c1x1⊕. . .⊕c12...nx1x2. . . xn (2) with ci1...ik’s in F2. The highest number of terms in a monomial with nonzero
coefficient is called the degree of f. The Boolean functions with degree 1 are calledaffine and in particular forc0= 0, the functions are calledlinear.
The distance between two Boolean functionsf andgis defined as the number of different entries in their truth table and denoted byd(f, g), i.e., the weight of
f⊕g. Walsh transform off is defined to be
Wf(α) =
X
x∈Fn 2
Nonlinearity of a Boolean functionf, denoted asN l(f) is the minimum distance off to the set of all affine functions, which is
2n−1−1
2maxα {|Wf(α)|}. (3) Nonlinearity of a Boolean function is bounded by 2n−1−2n/2−1. The Boolean
functions with even number of variables that achieve this bound are called bent functions. Weight of bent functions can take two values 2n−1±2n/2−1, i.e., they
are not balanced, thus not very useful in cryptographic applications.
Two n-bit Boolean functions f(x) and h(x) are called affine equivalent, if
h(x) =f(Ax+b), whereAis annbynbinary non-singular matrix andbis an
n-bit binary vector and it is known thatN l(f) andN l(h) are equal.
2.2 Feedback Shift Registers
A FSR is a device that shifts its contents into adjacent positions within the register and fills the position on the other end with a new value generated by the feedback function. The individual delay cells of the register are called the
stages and the number of the stagesnis called thelength of FSR. The contents of thenstages are called thestateof the FSR. Thenbit vector (s0, s1, . . . , sn−1)
initially loaded into FSR state specify theinitial state. A block diagram of a FSR is given in Figure 1.
Fig. 1. Block diagram of a Feedback Shift Register.
A FSR is uniquely determined by its lengthnandnvariable Boolean feedback function f(x1, x2, . . . , xn). The output sequence S= {s0, s1, s2, . . .} of a FSR
satisfy the following recursion
sn+i=f(si, . . . , sn−1+i), i≥0 (4) given the initial state (s0, s1, . . . , sn−1).
For LFSRs, this recursion is linear and may be represented using the char-acteristic polynomial,
C(x) = n
X
i=0
with c0 = 1. If C(x) is a primitive polynomial with degreen, then each of the
2n−1 non-zero initial states of the LFSR produce an output with maximum possible period 2n−1. Outputs of maximum-length LFSRs are calledmaximal
length sequences orm-sequences.
LetLn be the set of all linear feedback functions that generatem-sequence. The number of primitive polynomial of degreenoverF2is given byφ(2n−1)/n,
whereφ(n) is the Euler’s phi function, hence
|Ln|=φ(2n−1)/n. (6) For NFSRs, the output sequences can achieve the period of 2n. Such se-quences include each n-bit pattern exactly once and are called de Bruijn se-quences. Let Dn be the set of all feedback functions that generate de Bruijn sequence and
|Dn|= 22 n−1−n
[10]. (7)
3
NFSRs and de Bruijn Sequences
3.1 Properties of Maximum-Length NFSRs
In this part of the study, we survey some of the necessary conditions of the feedback functionf(x1, . . . , xn) to generate de Bruijn sequences.
To guarantee that every state has a unique predecessor and successor, f
should be written in the formf(x1, . . . , xn) =x1+g(x2, . . . , xn) [1]. Some nec-essary conditions on f and g to generate a de Bruijn sequence are given as follows;
1. To avoid all zero cycle,f(0, . . . ,0) = 1, i.e.c0= 1. Due to unique predecessor
and successor property,f(1,0, . . . ,0) = 0.
2. To avoid all one cycle,f(1, . . . ,1) = 0, therefore the number of monomials in
f is even. Due to unique predecessor and successor property,f(0,1, . . . ,1) = 1.
3. To avoid the cycle (00. . .01), there exists a coefficientci= 0, fori= 2, . . . , n [11].
4. The parity of the cycles generated by a FSR is equal to the parity of the truth table ofg[1]. To achieve one maximum-length cycle, parity of the truth table ofg should be 1, which impliesc23...n= 1.
5. The weight w(g) ofg satisfies the following inequality
Zn−1≤w(g)≤2n−1−Zn∗+ 1 (8) whereZn is n1Pd|nφ(d)2n/dandZn∗ is
Zn
2 − 1 2n
Pφ(2d)2n/2dwith summa-tion over all even divisors ofn[7].
6. Letf =x1+g(x2, . . . , xn) generate a de Bruijn sequence andn >2. Then,
g(x2, . . . , xn)6=g(xn, . . . , x2), (9)
4
On The Nonlinearity of Feedback Functions
In this part of the paper, we study on the nonlinearity of the feedback functions that generate de Bruijn sequences.
Proposition 1. Let f(x1, . . . , xn)∈Dn. The nonlinearity of f satisfies
N l(f)≡2 (mod4).
Proof. Due to the unique predecessor and successor property, f has the form;
f = x1+g. For any linear function l, g⊕l includes the monomial x2· · ·xn,
therefore weight of g⊕l is always odd. This guarantees that nonlinearity of g
is odd. Let N l(g) = 2k+ 1, then N l(f) = 2(2k+ 1) = 4k+ 2, hence N l(f)≡ 2 (mod4).
Next, we show some upper bounds on the nonlinearity off ∈ Dn. As men-tioned in Section 2, nonlinearity of an n-variable Boolean function is bounded by 2n−1−2n/2−1. Since the functions achieving this bound are not balanced, they cannot generate de Bruijn sequences. Next proposition provides an upper bound on the nonlinearity off ∈ Dn based on the weight ofg,w(g).
Proposition 2. The nonlinearity off ∈ Dn is bounded by
N l(f) ≤min{2n−2Z∗
n+ 2,2n−2Zn−1}.
Proof. According to [7], the weight ofg satisfies the following inequality
Zn−1≤w(g)≤2n−1−Zn∗+ 1.
Since the distance between g and the constant zero function is w(g), N l(g)≤
w(g) andN l(f) ≤ 2w(g). Then
N l(f)≤2n−2Zn∗+ 2 (10) is satisfied. Similarly, the distance between g and the constant one function is equal to 2n−1−w(g). Then,
N l(f)≤2n−2Zn−1 (11)
is satisfied. Combining (10) and (11), nonlinearity off is bounded by
N l(f) ≤min{2n−2Z∗
n+ 2,2n−2Zn−1}.
It should be noted these bounds are not tight, as they are only based on the weight ofg, not on the location of 1’s in the truth table ofg. Another bound for the nonlinearity off is provided in the next proposition.
Proposition 3. The nonlinearity off ∈ Dn is bounded by
2n−1−2(n−1)/2,
Proof. The nonlinearity of the (n-1)-variable Boolean function g is bounded by
2(n−2)−2(n−3)/2. It is known that forn >2, degree of ann-variable bent function
is bounded byn/2. Since the degree of g isn−1, this bound cannot be achieved by g. Therefore, the following is satisfied;
N l(f)<2(2(n−2)−2(n−3)/2)
<2n−1−2(n−1)/2.
Table 1 shows two upper bounds on the nonlinearity off. The first bound is the generic nonlinearity bound for Boolean functions, whereas the second bound is obtained using Proposition 1 and 3.
n Bound 1 Bound 2
5 13 10
6 28 26
7 58 54
8 120 114
9 244 238
10 496 486
Table 1.Nonlinearity bounds on theN l(f).
Letγn(c) denote the number of n-variable maximum-length feedback func-tions with nonlinearity c. Trivially, P
cγn(c) = 22 n−1−n
. The value of γn(c) for arbitrary nand c is not known. According to the Proposition 1,γn(4k) =
γn(4k+ 1) =γn(4k+ 3) = 0,k≥0. Table 2 shows the distribution ofγn(c) for
n= 5,6.
Proposition 4. γn(c)≡0 (mod 4), for evenn≥3.
Proof. The complement cS and the reverse rS of a de Bruijn sequence S = {s0, s1, . . . , s2n−1} is defined to be cS ={s00, s01, . . . , s02n−1} where s0i is the
bi-nary complement of si and rS = {s2n−1, . . . , s1, s0}. Let f(x1, x2, . . . , xn) ∈ Dn generate S, then f(x1, x02, . . . , x0n)generates cS and f(x1, xn, xn−1, . . . , x2)
generates rS [7]. Since f(x1, . . . , xn), f(x1, x02, . . . , x0n), f(x1, xn, . . . , x2) and
f(x1, x0n, x0n−1, . . . , x02) are affine equivalent, the nonlinearity of feedback
func-tions generating S,rS,cS and rsS are equal. In [12], it is shown that S,rS,cS
andrsS are distinct sequences, for evenn. Hence,γn(c) ≡ 0(mod 4) for even
n≥3.
4.1 Feedback Functions with Nonlinearity 2
n c γn(c)
5
2 24
6 1128 10 896
6
2 32
6 7408 10 352,752 14 6,491,072 18 42,601,512 22 17,656,088
Table 2.The distribution ofγn(c) forn= 5,6.
Proposition 5. LetF =c1xn+c2xn−1+. . .+cnx+ 1be a primitive polynomial
with degreenover the finite field GF(2).
(i) f1(x1, . . . , xn) =c1x1+c2x2+. . .+cnxn+x02x03· · ·x0n ∈ Dn [1] andN l(f1) =
2.
(ii) f2(x1, . . . , xn) = 1 +c1x1+c2x2+. . .+cnxn +x2x3· · ·xn ∈ Dn [9] and
N l(f2) = 2.
Proof. Given a primitive polynomialF(x), it is known that l(x) =c1x1+. . .+
cnxn generates a state diagram with two cycles, one of which is the all-zero cycle
and the other is a cycle of length2n−1.
(i) These two cycles can be combined by adding x02x03· · ·x0n to l(x), which is equivalent to changing the the truth table entries corresponding to(10. . .0)
and(00. . .0) [1]. Then, f1(x1, . . . , xn) = l(x) +x02x03· · ·x0n generates a
cy-cle with length 2n and since only two truth table entries of l are changed,
N l(f1) = 2.
(ii) Since F(x)is primitive, the number of monomials in F(x), also in l(x), is odd, so l0(x) = c1x10 +. . .+cnx0n = 1 +c1x1+c2x2+. . .+cnxn. l0(x)
generates two cycles one of which is the all-one cycle and the other one is the cycle of length2n−1, which are the complements of the cycles generated
byl(x). These two cycles are combined by addingx2x3· · ·xn tof(x), which
is equivalent to changing the truth table entries corresponding to(011. . .1)
and(11. . .1), therefore N l(f2) = 2.
Primitive polynomial Feedback Functions with Nonlinearity 2 1 +x2+x5 x1+x4+x
0
2x03x04x05
1 +x1+x4+x2x3x4x5
1 +x+x2+x3+x5 x1+x3+x4+x5+x
0
2x03x04x05
1 +x1+x3+x4+x5+x2x3x4x5
1 +x3+x5 x1+x3+x
0
2x03x04x05
1 +x1+x3+x2x3x4x5
1 +x+x3+x4+x5 x1+x2+x3+x5+x
0
2x03x04x05
1 +x1+x2+x3+x5+x2x3x4x5
1 +x2+x3+x4+x5x1+x2+x3+x4+x
0
2x03x04x05
1 +x1+x2+x3+x4+x2x3x4x5
1 +x+x2+x4+x5 x1+x2+x4+x5+x
0
2x03x04x05
1 +x1+x2+x4+x5+x2x3x4x5
Table 3. Construction off with nonlinearity 2, for n=5, using primitive poly-nomials.
Example 1. The cycle decomposition of affine function f = 1 +x1+x3+x5
includes two cycles; (000001011011100111110100100011) and (01). The long cy-cle includes all n-bit patterns except (10101) and (01010). The (01) pattern is embedded to the long cycle such that the new generated cycle includes alln-bit patterns and it can be done in two ways as shown in the following figure.
New sequence Feedback function
(00000101011011100111110100100011)f + (x3 + x5)x02x04
(00001011011100111110101001000110)f + (x2 + x4)x03x05
Table 4.Combining the two cycles off = 1 +x1+x3+x5
Proposition 6. The number of maximum-length feedback functions with non-linearity 2 satisfies
2φ(2 n−1)
n ≤γn(2)≤2
2n, (12)
whereφ(n)is the Euler’s phi function.
Affine function Cycle decomposition # cycles 1 +x1+x2+x3+x5 (0000010111011010100111100011001) (1) 2
1 +x1+x2+x3+x4 (0000011011001111010010101110001) (1) 2
1 +x1+x4 (0000011001011011110101000100111) (1) 2
1 +x1+x3 (0000011100100010101111011010011) (1) 2
1 +x1+x3+x4+x5 (0000010001110101001011110011011) (1) 2
1 +x1+x2+x4+x5 (0000010011000111100101011011101) (1) 2
1 +x1+x3+x5 (000001011011100111110100100011) (01) 2
1 +x1+x2+x4 (000001100010010111110011101101) (01) 2
1 +x1+x2+x3 (0000011101011011111000101001) (0011) 2
1 +x1+x4+x5 (0000010010100011111011010111) (0011) 2
1 +x1 (0000011111) (0001011101) (0010011011) (01) 4
1 +x1+x5 (000001010110011101111) (0001101) (001) (1) 4
1 +x1+x3+x4 (000001101011) (0001) (001010011111) (0111) 4
1 +x1+x2 (000001111011100110101) (0001011) (001) (1) 4
1 +x1+x2+x5 (00000101) (00011011) (00100111) (01011111) 4
1 +x1+x2+x3+x4+x5 (000001) (000111) (001011) (001101) (01) (011111) 6
Table 5.Cycle decompositions of affine functions withc0= 1, for n=5.
γn(2)is lower bounded by 2 times the number of primitive polynomials, which is
equal to 2φ(2nn−1).
The number of Boolean functions having nonlinearity2is calculated by count-ing the number of 2 possible changes to all affine functions and is equal to
2n 2
2n+1. For the functions in D
n, the changes should be symmetric, in other
words, f(a1, a2, . . . , an) and f(a1+ 1, a2, . . . , an) should be changed
simultane-ously. Therefore, the number of feedback functions with nonlinearity 2 is upper bounded by 2n1−12n+1= 22n.
Proposition 7. The number of maximum-length feedback functions with non-linearityt is bounded by
γn(t)≤
2n−1
t/2
2n+1, (13)
for event <2n−2.
Proof. The number of functions having nonlinearity t is calculated by counting the number oft possible changes to all affine functions and is equal to 2tn
2n+1,
for t <2n−2 [13]. Since the changes should be symmetric, the total number of
changes that can be given to an affine function is bounded by 2n−t/12−2
4.2 Cross-joining to Increase Nonlinearity
Cross-joining is a well-known method to construct maximum-length feedback functions given another feedback function [7]. Given f ∈ Dn, the method first flips one position of the truth table of g, this splits the output of f into two cycles. Then, if a second position in the truth table ofgexists, such that flipping it combines the two cycles to produce a new cycle of length 2n, then this pair of positions is called across-join pair.
In the previous section, construction of feedback functions with nonlinearity 2 is described. By cross-joining, the nonlinearity of the feedback functions can be improved. Cross-joining flips four positions of the truth tables, therefore the nonlinearity of the newly constructed feedback function is bounded byN l(f)+4. Helleseth and Kløve [14] proved that the number of cross-join pairs in an n-bit maximum-length LFSR is (2n−1−1)(2n−1−2)/6.
Cross-joining is also equivalent to dividing a de Bruijn sequence into five parts and permuting the parts as given in Figure 2. The permutation basically interchanges the positions of the part II and part IV. It is possible to verify that the sequence generated by interchanging the positions of the unique runs ofnandn−2 zeros in a de Bruijn sequence, is also a de Bruijn sequence. This is also true for interchanging the unique runs ofnandn−2 ones [12].
(←I→ || ←II → || ←III→ || ←IV → || ←V →) ⇐⇒
(←I→ || ←IV → || ←III→ || ←II → || ←V →)
Fig. 2. Cross join pair effect on de Bruijn sequence
Proposition 8. If f(x1, . . . , xn) ∈ Dn, then f1 = f ⊕(x2⊕xn)x30x04. . . x0n−1
andf2=f⊕(x2⊕xn)x3x4. . . xn−1∈ Dn.
Proof. The monomial (x2 ⊕xn)x30x04. . . x0n−1 takes the value 1 in four
posi-tions of the truth table of f, i.e. flips the output of f in the following inputs;
f(0,1,0, . . . ,0), f(1,1,0, . . . ,0), f(0, . . . ,0,1), f(1,0, . . . ,0,1). These changes results in interchanging the runs of n andn−2 zeros. Similarly, adding (x2⊕
xn)x3x4. . . xn−1, changes the following outputs off;f(0,1, . . . ,1,0),f(1,1, . . . ,1,0),
f(0,0,1. . . ,1),f(1,0,1, . . . ,1). These changes results in interchanging the runs of nandn−2 ones. Therefore,f1 andf2 also generate de Bruijn sequences.
4.3 Number of Monomials
Hardware efficiency of NFSRs is extremely important, especially for stream ci-phers designed for restricted environments. In general, the feedback functions with less number of monomials are implemented more efficiently in hardware and these functions are of interest. C¸ alık et al. [9] studied the number of mono-mials in the maximum-length feedback functions and showed that it is at least 4.
Proposition 9. Let f ∈ Dn be a 4-monomial feedback function.
N l(f)≤ 2 n
n−1.
Proof. 4-monomial feedback functions are of the form;
f(x1, x2, . . . , xn) = 1 +x1+x2· · ·xn+h(x2, . . . , xn),
where the degree ofh(x)is upper bounded bylog2n[9]. Nonlinearity off is equal
to 2N l(h(x) +x2· · ·xn) and the weight of h(x) +x2· · ·xn, which is equal to 2n−1−deg(h(x))−1, gives two upper bounds on the nonlinearity.
N l(h(x) +x2· · ·xn)≤min{2n−1−deg(h(x))−1,2n−1(1−2−deg(h(x)) + 1} ≤min{2n−1−log2n−1,2n−1(1−2log2n) + 1} ≤min{2n−1/n−1,2n−1(1−1/n) + 1} ≤2n−1/n−1.
Then, N l(f)≤ 2n
n−1 is satisfied.
C¸ alık et al. [9] conjectured that for n > 12, the degree of h(x) is 1, after experimenting for n≤36. Assuming the conjecture is true, we can say that the nonlinearity of 4-monomial feedback functions is 2 forn >12.
The maximum number of monomials in a maximum-length feedback function is 2n−1 and these functions are of the form
f =x1+x02· · ·x
0
n+xi,
for 2≤i ≤n [9]. It is easy to verify that the nonlinearity of these functions is also 2.
5
Conclusion
References
1. S. W. Golomb.Shift Register Sequences. Holden-Day, Inc., Laguna Hills, CA, USA, 1967.
2. A. J. Menezes, P. C. van Oorschot, and S. A. Vanstone. Handbook of Applied Cryptography. CRC Press, Boca Raton, Florida, 1996.
3. A. Braeken and J. Lano. On the (Im)Possibility of Practical and Secure Nonlinear Filters and Combiners. InSelected Areas in Cryptography, pages 159–174, 2005. 4. M. Hell, T. Johansson, and W. Meier. Grain - A Stream Cipher for Constrained
Environments. eSTREAM, ECRYPT Stream Cipher Project, Report 2005/010, 2005.
5. S. Babbage and M. Dodd. The Stream Cipher MICKEY (version 1). eSTREAM, ECRYPT Stream Cipher Project, Report 2005/015, 2005.
6. C. De Canni`ere and B. Preneel. Trivium Specifications. eSTREAM, ECRYPT Stream Cipher Project, Report 2005/030, 2005.
7. H. Fredricksen. A Survey of Full Length Nonlinear Shift Register Cycle Algorithms. 24(2):195–221, 1982.
8. A. Tsuneda, K. Kudo, D. Yoshioka, and T. Inoue. Maximal-Period Sequences Generated by Feedback-Limited Nonlinear Shift Registers. IEICE Transactions, 90-A(10):2079–2084, 2007.
9. C¸ . C¸ alık, M. S¨onmez Turan, and F. ¨Ozbudak. On Feedback Functions of Maximum Length Nonlinear Feedback Shift Registers. IEICE Transactions, 93-A(6):1226– 1231, 2010.
10. N. G. de Bruijn. A Combinatorial Problem. In Proceedings of the Koninklijke Nederlandse Akademie van Wetenschappen. Series A, 49(7):758–764, 1946. 11. R. Gonzalo, D. Ferrero, and M. Soriano. Some Properties of Non Linear Feedback
Shift Registers with Maximum Period. Proc. Sixth Int. Conf. Telecommunications Systems, 1998.
12. T. Etzion and A. Lempel. On the Distribution of de Bruijn Sequences of Given Complexity. IEEE Transactions on Information Theory, 30(4):611–614, 1984. 13. C.K. Wu. Distribution of Boolean Functions with Nonlinearity 2(n−2). In
Proceed-ings of ChinaCrypt’94, pages 10–14, China, 1994. Springer-Verlag.
